An ESG framework for banks is the structured way an institution identifies, measures, manages, and discloses environmental, social, and governance risks alongside its traditional financial metrics. Building one in 2026 means designing for a split regulatory picture: U.S. federal agencies have withdrawn climate-specific guidance, while the European Union and international standard-setters keep expanding disclosure requirements, and roughly 18 states have laws that can penalize banks for the same ESG choices investors elsewhere reward. The framework has to work across all of that.
The Three Pillars a Bank Framework Covers
Environmental
The environmental pillar focuses on how climate change and resource constraints affect a bank’s loan book and investment portfolio. Banks analyze “financed emissions,” meaning the carbon footprint of the companies and projects they fund through lending. Heavy exposure to fossil fuel extraction or carbon-intensive manufacturing carries transition risk if those borrowers lose value as the economy shifts. Physical risks matter too: a mortgage portfolio concentrated in flood-prone coastal areas has a different risk profile than one spread across geographies. The pillar asks the bank to quantify those exposures and factor them into credit decisions.
Social
Social considerations track how the bank treats employees, serves customers, and affects the communities where it operates. Internally, this covers pay equity, workforce diversity at every seniority level, workplace safety, and retention. Externally, it includes financial inclusion for underserved populations, affordable housing lending, and small business support. A bank that systematically excludes segments of its market from fair access to credit faces regulatory and litigation risk regardless of its stated ESG position.
Governance
Governance covers how the bank is managed with transparency and accountability at the board level and throughout the organization. Board diversity, independence of directors, alignment of executive pay with long-term performance, and the strength of internal compliance programs all sit here. Anti-money laundering controls and whistleblower protections are governance metrics that directly affect a bank’s regulatory standing and its ability to maintain charter authority.
The Split Regulatory Picture in 2026
The U.S. Pullback
The SEC adopted climate-related disclosure rules in March 2024 that would have required public companies, including publicly traded banks, to report greenhouse gas emissions, climate risk management, and the financial effects of severe weather. Those rules never took effect. The SEC stayed them, withdrew its defense in early 2025, and in June 2026 formally proposed rescinding them entirely.1Securities and Exchange Commission. SEC Votes to End Defense of Climate Disclosure Rules2Federal Register. Rescission of Climate-Related Disclosure Rules
In October 2025, the Federal Reserve, FDIC, and OCC jointly withdrew their “Principles for Climate-Related Financial Risk Management for Large Financial Institutions,” stating that existing safety and soundness standards already require banks to manage all material financial risks without climate-specific guidance.3Federal Deposit Insurance Corporation. Agencies Announce Withdrawal of Principles for Climate-Related Financial Risk The Department of Labor also dropped its defense of the ERISA rule that had permitted retirement plan fiduciaries to consider ESG factors.
None of this means U.S. banks can ignore ESG risks. General securities law still requires disclosure of any material risks to business operations and financial condition, and climate exposure, stranded asset risk, and governance failures can all be material. What changed is that no standalone federal ESG disclosure mandate currently applies.
European and International Requirements
The EU’s Sustainable Finance Disclosure Regulation requires financial market participants to disclose how they integrate sustainability risks into investment decisions and advisory processes.4Legislation.gov.uk. Regulation (EU) 2019/2088 of the European Parliament and of the Council Any bank marketing financial products to EU investors or managing assets for EU-based clients falls within scope, regardless of where it is headquartered.
The EU’s Corporate Sustainability Reporting Directive has been narrowed by a February 2025 legislative proposal to companies with more than 1,000 employees, and reporting deadlines for later waves have been postponed.5European Commission. Corporate Sustainability Reporting Banks large enough to meet the threshold still need to comply, and the directive’s “double materiality” concept, which evaluates both how sustainability issues affect the bank and how the bank affects environment and society, shapes the whole framework design.
Internationally, the IFRS Foundation’s International Sustainability Standards Board took over the monitoring work of the disbanded Task Force on Climate-related Financial Disclosures starting in 2024.6IFRS Foundation. IFRS Foundation Welcomes Culmination of TCFD Work and Transfer of Responsibilities IFRS S1 and IFRS S2 became effective for reporting periods beginning on or after January 1, 2024, and require disclosure of governance processes, strategy, risk management, and performance metrics related to sustainability risks and opportunities that could affect cash flows or access to capital.7IFRS Foundation. IFRS S1 General Requirements for Disclosure of Sustainability-Related Financial Information Jurisdictions are adopting these standards at different paces.
Basel Principles
The Basel Committee on Banking Supervision published 18 high-level principles for managing climate-related financial risks in 2022, covering corporate governance, internal controls, risk assessment, and supervisory expectations.8Bank for International Settlements. Principles for the Effective Management and Supervision of Climate-Related Financial Risks The principles are not directly enforceable, but national regulators use them as a benchmark for banks operating in their jurisdictions.
Where State Law Conflicts With ESG Choices
Roughly 18 U.S. states have laws restricting or discouraging ESG considerations by financial institutions, and those laws can directly conflict with the framework a bank builds. They fall into two categories.
“Anti-boycott” laws prohibit state governments from investing public funds in or awarding contracts to financial institutions that restrict business dealings with certain industries, particularly fossil fuels and firearms. Several states maintain published lists of financial companies deemed to be engaging in boycotts, and listing can trigger mandatory divestment of public pension funds and exclusion from government contracts. A bank that limits lending to certain sectors as part of an ESG strategy risks landing on these lists even when the decision rests on credit risk analysis. Arkansas and Texas, among others, have rejected the argument that ESG policies serve an ordinary business purpose.
“Fair access” laws go further, prohibiting financial institutions from using ESG criteria to deny services to customers in any context. The OCC finalized a rule in 2021 requiring large national banks to make products and services available based on quantitative, risk-based standards rather than categorical exclusions.9Office of the Comptroller of the Currency. OCC Finalizes Rule Requiring Large Banks to Provide Fair Access to Bank Services, Capital, and Credit A nationally operating bank cannot simply decline to serve an entire industry category and frame it as an ESG commitment without risking regulatory action or the loss of state government business.
Running a Materiality Assessment
Before collecting data or drafting disclosures, a bank has to determine which ESG topics actually matter to its operations and stakeholders. Getting the assessment wrong means either wasting resources on irrelevant metrics or missing exposures that investors and regulators care about.
Under the double materiality concept used in the EU framework, the assessment runs in two directions. The “inside-out” analysis evaluates how the bank’s activities affect the environment and society: does the loan portfolio fund deforestation, do lending patterns exclude minority communities. The “outside-in” analysis asks the opposite: how do sustainability factors affect the bank’s financial health, will carbon transition costs cause borrower defaults, could water scarcity reduce collateral values in agricultural lending.
Practically, the work starts with mapping stakeholders and gathering input from investors, regulators, employees, and community groups about which issues they consider significant. The bank then inventories its operations, lending portfolio, and supply chain to identify where environmental and social impacts concentrate. Each topic is scored for severity and likelihood on both dimensions. Topics that score high on either dimension qualify as material and need to be tracked, managed, and disclosed. The assessment should be refreshed regularly, because a portfolio that shifts toward renewable energy financing has a different materiality profile than one weighted toward commercial real estate.
Measuring What Matters
Scope 1, 2, and 3 Emissions
Scope 1 covers greenhouse gas emissions from sources the bank directly owns or controls, like heating in branch buildings or fuel burned by company vehicles. Scope 2 covers indirect emissions from purchased electricity, steam, or cooling.10U.S. Environmental Protection Agency. Scope 1 and Scope 2 Inventory Guidance For most banks these are small relative to operations. The number that dominates is Scope 3, specifically “financed emissions,” which captures the greenhouse gas output of every borrower and investment in the portfolio.
Measuring financed emissions is the hardest data challenge in framework development. The bank attributes a share of each borrower’s emissions based on the proportion of financing provided. Hold 10% of a power company’s total debt, claim 10% of its reported emissions. Across thousands of borrowers with varying data quality, the complexity compounds fast.
The PCAF Methodology
The Partnership for Carbon Accounting Financials provides the most widely adopted methodology for calculating financed emissions. The PCAF standard, reviewed by the GHG Protocol and found in conformance with its Scope 3 accounting requirements, gives banks a consistent formula: divide the bank’s outstanding financing by a financial indicator of the borrower (such as total enterprise value), then multiply by the borrower’s emissions.11Partnership for Carbon Accounting Financials. The Global GHG Accounting and Reporting Standard for the Financial Industry The third edition, published in January 2026, covers ten asset classes ranging from listed equity and corporate bonds through mortgages and sovereign debt.
Banks are expected to use the best available data and publish a weighted data quality score alongside their financed emissions figures. Because borrower emissions data often lags by a year or more, the standard allows financial data and emissions data to represent different reporting periods, provided the bank discloses the mismatch. An optional methodology for undrawn loan commitments was added in the 2025 edition to align with IFRS S2.
Social and Governance Metrics
Social data comes primarily from internal HR systems: demographic breakdowns by seniority level, retention rates, pay equity comparisons across gender and race, and workplace safety records. ISO 30414 provides a standardized framework for human capital reporting covering workforce diversity, productivity indicators like revenue per employee, engagement survey results, and turnover rates. Adopting these metrics creates a baseline for year-over-year comparison and external benchmarking.
Governance metrics are more qualitative but no less important: board independence ratios, the presence of ESG-specific board committees, executive compensation structures tied to sustainability targets, and the rigor of anti-money laundering and compliance programs. Documentation showing that leadership actively reviews and acts on ESG data strengthens the framework’s credibility with regulators and investors.
Avoiding Greenwashing Liability
Even with federal ESG-specific disclosure mandates receding, SEC enforcement against misleading ESG claims remains active. The logic is straightforward: if a bank or its investment management arm tells investors that a fund screens for ESG criteria and that screening is sloppy, incomplete, or nonexistent, existing anti-fraud provisions apply.
In November 2024, the SEC charged Invesco Advisers with willfully violating the Investment Advisers Act of 1940 for overstating the percentage of assets under management that integrated ESG factors, resulting in a $17.5 million civil penalty.12Securities and Exchange Commission. SEC Charges Invesco Advisers for Making Misleading Statements About ESG Earlier in 2024, WisdomTree Asset Management settled similar charges for $4 million over material misstatements about fossil fuel and tobacco screening in fund prospectuses. The common failure modes: overbroad claims in marketing materials about what a fund excludes, inadequate oversight of third-party ESG data vendors, and a lack of internal policies governing how ESG screening decisions are actually made.
The pattern is clear. Banks do not need to make ESG commitments, but any commitments they do make need to be accurate, documented, and backed by procedures that match the public claims. Rebranding an existing fund with ESG language without changing the underlying investment process is exactly what triggers SEC scrutiny.
ERISA Limits for Plan-Advising Banks
Banks that manage or advise retirement plans face an additional layer of legal risk that a general ESG framework does not cover on its own. ERISA’s fiduciary duties require that every action taken with respect to plan assets serve the exclusive purpose of maximizing risk-adjusted financial returns for participants.13U.S. Department of Labor. Application of ERISA Fiduciary Requirements and Preemption Provisions to Proxy Advisory Services Using plan assets to pursue environmental or social goals without a connection to enhancing economic value violates ERISA’s exclusive purpose and prudence requirements.
A 2022 Biden administration rule had created space for fiduciaries to consider ESG factors as part of risk-return analysis. In May 2025 the Department of Labor stopped defending that rule against a legal challenge brought by 26 state attorneys general, and new rulemaking is expected to tighten the boundary between permissible risk analysis and impermissible social investing. Banks advising retirement plans should treat ESG factors as relevant only when they have a demonstrable, documented connection to financial performance.
Reporting and Ongoing Monitoring
For publicly traded U.S. banks, financial disclosures are submitted through the SEC’s EDGAR system.14Securities and Exchange Commission. Submit Filings Any material risk disclosures, including those related to climate or governance, are embedded in annual reports and registration statements filed through EDGAR. A separate public-facing ESG or sustainability report on the bank’s website provides additional detail for investors and stakeholders who want more granularity than the SEC filing contains.
Internal audit teams verify that published figures match the underlying source data before anything goes public. A mismatch between a bank’s sustainability report and its SEC filings creates exactly the inconsistency that regulators and plaintiff attorneys look for. Banks subject to EU requirements face additional assurance obligations: the CSRD framework phases in third-party auditing of sustainability disclosures, starting with limited assurance for the largest filers and eventually requiring reasonable assurance.
Most banks update ESG disclosures annually, with quarterly updates common for metrics tied to financial reporting cycles. The materiality assessment should be reviewed at least annually as well, because changes in the loan portfolio, new regulations, or shifts in investor expectations can alter which topics qualify as material. When a regulator sends an inquiry about a disclosure, the response should pull original source documentation and reply within the specified window. Framework work is a process, not a project, and the banks treating it as the latter tend to be the ones with stale data and enforcement problems.